Information processing method, device, storage medium and equipment

Abstract

The disclosed embodiments disclose information processing methods, devices, storage media and equipment. The method includes: splitting the original alarm rule expression corresponding to the original alarm rule source code information into alarm rule elements, and filtering out the target alarm rule elements containing adjustable items from the split alarm rule elements, and visually outputting the changes in historical data corresponding to the target alarm rule elements, so that the user can input the adjustment target information of the corresponding adjustable items according to the visual output results, adjust the corresponding adjustable items according to the received adjustment target information, and generate the target alarm rule source code information according to the adjusted alarm rule elements. By adopting the above technical solution, users can more intuitively view the changing trend of historical data, and then quickly set reasonable target values ​​for adjustable items, thereby improving the debugging efficiency of the alarm rule source code.

Description

Technical Field

[0001] The embodiments of the present disclosure relate to the field of computer technology, and in particular, to information processing methods, devices, storage media, and equipment. Background Art

[0002] With the rapid development of mobile Internet technology, the maintenance, management and monitoring of massive data are becoming increasingly important. At present, monitoring of various data or indicators can be achieved on monitoring platforms or monitoring systems. Such monitoring platforms usually have the functions of collecting and monitoring abnormal data and issuing abnormal alarms when abnormalities occur.

[0003] At present, the alarm modes of data anomaly monitoring platforms are all based on alarm rules. For example, an alarm is triggered when the value of a data indicator exceeds the corresponding threshold, an alarm is triggered when the number of occurrences of a certain error exceeds the preset number, and so on. Developers can write various alarm rules according to different business needs. Alarm rules usually include adjustable items such as thresholds, and developers can adjust the adjustable items to achieve a more ideal monitoring effect. However, in the prior art, developers can generally only set the specific values ​​of the adjustable items based on experience, or try different values ​​many times and adjust them repeatedly according to the monitoring results, making it difficult to quickly and accurately obtain appropriate alarm rules. Summary of the invention

[0004] The embodiments of the present disclosure provide information processing methods, devices, storage media, and equipment, which can optimize existing information processing solutions.

[0005] In a first aspect, an embodiment of the present disclosure provides an information processing method, including:

[0006] Obtain the original alarm rule expression corresponding to the original alarm rule source code information;

[0007] Splitting the original alarm rule expression into alarm rule elements, and filtering out target alarm rule elements from the alarm rule elements obtained by splitting, wherein the target alarm rule elements include adjustable items;

[0008] Acquire historical data corresponding to the target alarm rule elements, and perform visual output processing on changes in the historical data, so that the user can input adjustment target information of the corresponding adjustable items according to the visual output results;

[0009] The corresponding adjustable items are adjusted according to the received adjustment target information, and the target alarm rule source code information is generated according to the adjusted alarm rule elements.

[0010] In a second aspect, an embodiment of the present disclosure provides an information processing device, including:

[0011] A rule expression acquisition module is used to obtain the original alarm rule expression corresponding to the original alarm rule source code information;

[0012] A target alarm rule element determination module is used to split the original alarm rule expression into alarm rule elements, and filter out target alarm rule elements from the split alarm rule elements, wherein the target alarm rule elements include adjustable items;

[0013] A visualization processing module, used to obtain the historical data corresponding to the target alarm rule elements, and perform visualization output processing on the changes of the historical data, so that the user can input the adjustment target information of the corresponding adjustable items according to the visualization output results;

[0014] The target alarm rule source code generation module is used to adjust the corresponding adjustable items according to the received adjustment target information, and generate the target alarm rule source code information according to the adjusted alarm rule elements.

[0015] In a third aspect, an embodiment of the present disclosure provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements an information processing method as provided in an embodiment of the present disclosure.

[0016] In a fourth aspect, an embodiment of the present disclosure provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, an information processing method as provided in the embodiment of the present disclosure is implemented.

[0017] The information processing scheme provided in the disclosed embodiment performs alarm rule element splitting on the original alarm rule expression corresponding to the original alarm rule source code information, and screens out the target alarm rule element containing the adjustable item from the split alarm rule elements, and performs visual output processing on the change of the historical data corresponding to the target alarm rule element, so that the user can input the adjustment target information of the corresponding adjustable item according to the visual output result, adjust the corresponding adjustable item according to the received adjustment target information, and generate the target alarm rule source code information according to the adjusted alarm rule element. By adopting the above technical scheme, the adjustable items in the alarm rule source code can be automatically screened out, and the change of the historical data corresponding to the alarm rule element to which the adjustable item belongs can be visualized, so that the user can view the change trend of the historical data more intuitively, and then quickly set the reasonable target value of the adjustable item, and then after the adjustment is completed, the adjusted target alarm rule source code information is automatically generated, thereby improving the debugging efficiency of the alarm rule source code. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1A flowchart of an information processing method provided by an embodiment of the present disclosure;

[0019] Figure 2 A flowchart of another information processing method provided by an embodiment of the present disclosure;

[0020] Figure 3 A flowchart of another information processing method provided by an embodiment of the present disclosure;

[0021] Figure 4 A schematic diagram of a syntax tree structure provided by an embodiment of the present disclosure;

[0022] Figure 5 A schematic diagram of another syntax tree structure provided in an embodiment of the present disclosure;

[0023] Figure 6 A schematic diagram of splitting alarm rule elements based on a syntax tree provided in an embodiment of the present disclosure;

[0024] Figure 7 A schematic diagram of a display interface provided by an embodiment of the present disclosure;

[0025] Figure 8 A schematic diagram of another display interface provided by an embodiment of the present disclosure;

[0026] Fig. 9 A schematic diagram of another display interface provided by an embodiment of the present disclosure;

[0027] Fig.10 Another schematic diagram of splitting alarm rule elements based on a syntax tree provided in an embodiment of the present disclosure;

[0028] Fig.11 A structural block diagram of an information processing device provided by an embodiment of the present disclosure;

[0029] Fig.12 A structural block diagram of a computer device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0030] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0031] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0032] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0033] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0034] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0035] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0036] In the following embodiments, each embodiment provides both optional features and examples. The various features recorded in the embodiments can be combined to form multiple optional solutions. Each numbered embodiment should not be regarded as only one technical solution.

[0037] Figure 1 The present disclosure provides a flowchart of an information processing method, which can be executed by an information processing device, wherein the device can be implemented by software and / or hardware, and can generally be integrated into a computer device. Figure 1 As shown, the method includes:

[0038] Step 101: Obtain the original alarm rule expression corresponding to the original alarm rule source code information.

[0039] In the disclosed embodiment, the alarm rule source code information may include text information that can reflect the alarm strategy and is written by a developer (hereinafter referred to as the user) in a preset programming language. The monitoring platform or monitoring system can support the identification of the alarm rule source code information and then apply it. The specific type of the preset programming language and the writing syntax of the original alarm rule source code information are not limited and can be selected according to actual needs. The source of the original alarm rule source code information is not limited and can be currently written by the user or obtained from the network or other devices. It can be the initially written alarm rule source code information or the alarm rule source code information after one or more debugging.

[0040] The disclosed embodiments do not limit the monitoring system used, for example, Bosun. Bosun is an open source monitoring and alarm system that has an expressive domain-specific language for evaluating alarms and creating detailed notifications, allowing users to test alarms based on historical records for a faster development experience. Bosun will be used as an example below. It is understandable that other similar monitoring systems are also applicable, such as Cabot, etc. Bosun is only used as an illustrative example.

[0041] In the disclosed embodiment, the alarm rule expression can be understood as an expression corresponding to a complete alarm rule, which can be formed by connecting multiple expressions through mathematical relationship symbols and / or logical operation symbols, etc., and generally a Boolean expression can be obtained in the end. The alarm rule expression corresponding to the original alarm rule source code information is recorded as the original alarm rule expression. In some cases, if the developer writes the alarm rule source code in the same writing method as the alarm rule expression, the original alarm rule source code information and the original alarm rule expression can be the same.

[0042] Step 102: split the original alarm rule expression into alarm rule elements, and filter out target alarm rule elements from the split alarm rule elements, wherein the target alarm rule elements include adjustable items.

[0043] Exemplarily, alarm rule elements can be understood as important components of alarm rules, and can be freely set according to the way the alarm rules are written. For example, alarm rule elements may include data source observation indicators, time series data monitoring targets, alarm trigger thresholds, alarm trigger conditions, and alarm trigger condition combinations, etc. It should be noted that only a few alarm rule elements that may exist in alarm rules are listed here, but it does not mean that all of the above alarm rule requirements need to be included in the alarm rules. In other words, the original alarm rule expression can contain one or more of the above alarm rule elements. In addition, more alarm rule elements can be designed, such as alarm function shutdown conditions, etc., and the alarm trigger thresholds can be further divided, such as variable thresholds and constant thresholds in the alarm trigger thresholds.

[0044] Exemplarily, the data source observation indicator can be understood as the name corresponding to the raw data in the data source to be monitored, which can be defined according to the actual situation. The data source may include a measurement library or database, such as Metrics or InfluxDB. Among them, Metrics is a measurement library for monitoring indicators, which provides many tools to help developers complete the monitoring of various data; InfluxDB is an open source distributed time series, event and indicator database written in Go language. Taking Metrics as an example, the data source observation indicator can be named metrics, and go.{psm}.numGos represents the number of goroutines (coroutines) of the psm (service name) service.

[0045] For example, the time series data monitoring target can be understood as the monitoring target set based on the time series data retrieved from the data source observation indicator, which can be recorded as target, where time series data can refer to time series data, and time series data can refer to the data column recorded in chronological order by the same unified indicator. For example, q("sum:rate:go.{psm}.numGos","5m","2m") represents the growth rate of goroutine per second in the query psm from 5 minutes to 2 minutes.

[0046] Exemplarily, the alarm trigger threshold can be understood as the threshold used to trigger the alarm, which can be recorded as threshold. For example, avg(q("sum:rate:go.{psm}.numGos","5m","2m"))>120, where 120 is the alarm trigger threshold, means that when the average growth rate of goroutine per second in the past 5 minutes to 2 minutes of psm is greater than 120, an alarm may be triggered (whether the alarm will be triggered depends on the subsequent combination of alarm trigger conditions).

[0047] Exemplarily, the alarm triggering condition can be understood as the condition for triggering the alarm, which can be recorded as condition, such as the above avg(q("sum:rate:go.{psm}.numGos","5m","2m"))>120, which as a whole can be regarded as an alarm triggering condition.

[0048] For example, as the alarm rules become more and more complex, multiple alarm trigger conditions may be required. The alarm trigger condition combination method can be understood as a combination of multiple alarm trigger conditions, which can be recorded as trigger. When the current situation meets the requirements of the alarm trigger condition combination method, the alarm is triggered. For example, condition1&&condition2, that is, when alarm trigger condition 1 and alarm trigger condition 2 are met at the same time, an alarm is triggered.

[0049] In the disclosed embodiment, after the original alarm rule expression is split into alarm rule elements, generally multiple alarm rule elements can be obtained, and the target alarm rule elements containing adjustable items are screened out from the split alarm rule elements. Among them, the adjustable items may include items in the alarm rule that allow the user to adjust, such as the alarm trigger threshold, and the time range in the time series data monitoring target (such as the above-mentioned 5 minutes and 2 minutes). The number of target alarm rule elements can be one or more, and the number of adjustable items contained in a target alarm rule element can also be one or more.

[0050] Step 103: Acquire historical data corresponding to the target alarm rule elements, and perform visual output processing on changes in the historical data, so that the user can input adjustment target information of the corresponding adjustable items according to the visual output results.

[0051] Exemplarily, the historical data may include data generated during the actual operation of the business, and may also include data generated during the trial operation of the business during the testing phase, etc., without specific limitation.

[0052] In the prior art, when debugging alarm rules, users can only see the historical data corresponding to all alarm rule expressions corresponding to each time point, and when the alarm rules are complex, the amount of historical data for each time point is also large, and it is difficult to filter out the data of current concern. When debugging, it is usually necessary to refer to historical data from a large number of time points, but the existing viewing method cannot see the connection between the data of concern between each time point. Therefore, not only is the workload huge, but it is also prone to errors, and it is difficult to quickly and accurately adjust the items that need to be adjusted to reasonable values.

[0053] In the disclosed embodiment, historical data corresponding to the target alarm rule elements are obtained in a targeted manner, so that the user can only focus on the historical data of the alarm rule elements of concern, reducing interference from other data. After the historical data corresponding to the target alarm rule elements are obtained, the changes in the historical data are processed for visual output, so that the user can intuitively see the changes in the historical data, which is convenient for summarizing the rules and adjusting the adjustable items more quickly and reasonably. The form of visual output processing is not specifically limited, for example, a table or statistical chart can be drawn and displayed in the display interface.

[0054] Exemplarily, an input control corresponding to the adjustable item may be displayed in the display interface, and the user may use the input control to input adjustment target information of the adjustable item. The adjustment target information may be an adjustment method or a specific value.

[0055] Step 104: Adjust the corresponding adjustable items according to the received adjustment target information, and generate target alarm rule source code information according to the adjusted alarm rule elements.

[0056] Exemplarily, after receiving the adjustment target information input by the user, the corresponding adjustable item is adjusted according to the adjustment target information. For example, when the adjustment target information includes an adjustment method, the adjustable item can be adjusted according to the adjustment method, such as increasing or decreasing; when the adjustment target information includes a specific value, the value of the adjustable item can be modified to the specific value.

[0057] The information processing scheme provided in the disclosed embodiment performs alarm rule element splitting on the original alarm rule expression corresponding to the original alarm rule source code information, and screens out the target alarm rule element containing the adjustable item from the split alarm rule elements, and performs visual output processing on the change of the historical data corresponding to the target alarm rule element, so that the user can input the adjustment target information of the corresponding adjustable item according to the visual output result, adjust the corresponding adjustable item according to the received adjustment target information, and generate the target alarm rule source code information according to the adjusted alarm rule element. By adopting the above technical scheme, the adjustable items in the alarm rule source code can be automatically screened out, and the change of the historical data corresponding to the alarm rule element to which the adjustable item belongs can be visualized, so that the user can view the change trend of the historical data more intuitively, and then quickly set the reasonable target value of the adjustable item, and then after the adjustment is completed, the adjusted target alarm rule source code information is automatically generated, thereby improving the debugging efficiency of the alarm rule source code.

[0058] For example, with the complexity and diversification of business, more and more data or indicators need to be monitored, and the alarm rules are becoming more and more complex. In order to facilitate flexible writing, some monitoring systems can allow developers to add custom variables in the process of writing alarm rule source code. For example, Bosun in the example above supports the ability to define variables. The custom variables here can be understood as variables that can be named and designed by developers themselves, relative to the variables that have been specified by the actual usage scenario. For example, go.{psm}.numGos in the example above may have different values ​​corresponding to different time points, which can be considered as a variable, but it is generally a prescribed writing method in the monitoring system, so it can be regarded as not a custom variable. When writing, developers can customize variables such as: $metrics = "sum: rate: go.{psm}.numGos", where $metrics can be considered a custom variable. For the sake of convenience, the variables appearing below can be understood as the custom variables described.

[0059] When the original alarm rule source code information contains custom variables, the original alarm rule source code information can be first de-variabled, that is, the custom variables contained therein are removed to become a pure operation expression. In some embodiments, the original alarm rule expression is a preset type expression, and the preset type expression does not contain custom variables. The original alarm rule expression corresponding to the original alarm rule source code information is obtained, including: replacing the original alarm rule source code information with custom variables to obtain the original alarm rule expression, wherein, in the process of performing the replacement process, the position information of the custom variables contained in the original alarm rule source code information in the original alarm rule expression is recorded. Correspondingly, the target alarm rule source code information is generated according to the adjusted alarm rule elements, including: generating the target alarm rule source code information according to the adjusted alarm rule elements and the position information. The advantage of such a setting is that the expression corresponding to the complete alarm rule that the monitoring system relies on when actually running can be obtained by replacing the custom variables, and the position information of the custom variables in the original alarm rule expression is recorded during the replacement process, so that the original custom variables can be accurately restored in subsequent operations, and the accurate target alarm rule source code information can be finally obtained.

[0060] For example, when replacing custom variables in the original alarm rule source code information, for a certain custom variable, it can be replaced with the expression corresponding to the custom variable that appeared previously. That is to say, for a certain custom variable, the custom variable may be referenced in other custom variables. For example, $q1=1+1, $q2=2+$q1, for the latter expression, it can be regarded as $q1 is referenced in $q2, and $q1 in the expression of $q2 can be replaced with the expression 1+1 of $q1 that appeared previously, and then $q2=2+1+1 can be obtained.

[0061] In some embodiments, the splitting of the alarm rule elements of the original alarm rule expression includes: constructing a syntax tree based on the original alarm rule expression; splitting the alarm rule elements according to the expressions corresponding to each node in the syntax tree. Correspondingly, the adjusting of the corresponding adjustable items according to the received adjustment target information and generating the target alarm rule source code information according to the adjusted alarm rule elements include: adjusting the corresponding adjustable items in the syntax tree according to the received adjustment target information; generating the target alarm rule source code information according to the adjusted syntax tree and the position information. The advantage of this is that by constructing the syntax tree corresponding to the original alarm rule expression, the original alarm rule expression can be better parsed, and the mathematical and logical relationships contained in the original alarm rule expression can be clarified, so as to realize the splitting of the alarm rule elements more reasonably and accurately. After adjusting the corresponding adjustable items in the syntax tree, the target alarm rule source code information can be directly generated according to the adjusted syntax tree and the position information of the custom variables in the original alarm rule expression.

[0062] Exemplarily, take the alarm rule elements including time series data monitoring targets, alarm triggering thresholds, alarm triggering conditions and alarm triggering condition combinations as an example. The alarm rule element splitting according to the expressions corresponding to each node in the syntax tree includes: determining the first expression corresponding to the first node in the syntax tree as the alarm triggering condition, wherein the first expression contains mathematical relationship symbols; determining one side of the mathematical relationship symbols in the first expression as the time series data monitoring target, and the other side as the alarm triggering threshold; determining the second expression corresponding to the second node in the syntax tree as the alarm triggering condition combination, wherein the second expression includes the alarm triggering condition, and when the second expression contains at least two alarm triggering conditions, the at least two alarm triggering conditions are connected by logical operation symbols. The advantage of this setting is that each alarm rule element can be identified more accurately.

[0063] Exemplarily, mathematical relationship symbols may include, for example, “>” (greater than), “<” (less than), “>=” (greater than or equal to), “<=” (less than or equal to), “==” (equal to), and “!=” (not equal to), etc. The part associated with the mathematical relationship symbol can generally describe the condition for triggering the alarm. Therefore, the first expression containing the mathematical relationship symbol can be determined as the alarm triggering condition, and the number of the first nodes corresponding to the first expression can be one or more. For the alarm triggering condition, the general writing method is that the left side is the time series data monitoring target and the right side is the alarm triggering threshold. Of course, it can also be the opposite, which can be determined according to the actual writing situation. Logical operation symbols may include, for example, “&&” (logical AND), “||” (logical OR), and “!” (logical NOT), etc. The part associated with the logical operation symbol can generally describe the logical relationship between multiple conditions. Therefore, the second expression containing the logical operation symbol can be determined as the alarm triggering condition combination method. It should be noted that for some simple alarm rules, there may be only one alarm triggering condition, and the alarm triggering condition combination method can be regarded as equivalent to the alarm triggering condition.

[0064] Figure 2 A flowchart of another information processing method provided by the embodiment of the present disclosure is optimized based on the above optional embodiments and can be applied to the case where the original alarm rule source code information contains custom variables, such as Figure 2 As shown, the method may include:

[0065] Step 201: Replace the original alarm rule source code information with custom variables to obtain the original alarm rule expression. During the replacement process, the position information of the custom variables contained in the original alarm rule source code information in the original alarm rule expression is recorded.

[0066] Exemplarily, when performing the replacement process, a mapping diagram (map) of each custom variable (which can be represented by a variable name) and an expression can be first constructed, and the original alarm rule source code information can be divided according to line break symbols (such as '\n') to obtain multiple lines of source code information, and each line can be traversed for replacement processing. When performing the replacement process on each line, the variable name and expression can be distinguished by regular expressions or other forms of recognition methods, for example, by '(\$\w+)\s*=(.*)' to distinguish the variable name and expression. Determine whether the expression of the current variable contains other variables. If so, the expression associated with the other variable corresponding to the mapping diagram is used to replace the other variables in the expression of the current variable, and the relative position of the replaced other variable in the current variable is recorded (which can also be understood as an offset). That is, the relative position of the first custom variable contained in the original alarm rule source code information in the preset type expression corresponding to the second custom variable is recorded. The second custom variable here can be understood as the above-mentioned current variable, and the first custom variable can be understood as the above-mentioned other variable. As shown in the example above, $q1 can be regarded as the first custom variable, and $q2 can be regarded as the second custom variable. It is determined that the expression 2+$q1 of the second custom variable $q2 contains the first custom variable $q1. The expression 1+1 associated with $q1 in the mapping diagram is used to replace $q1 in the expression of $q2, and the relative position of $q1 in the preset type expression 2+1+1 of $q2 is recorded. Subsequently, the corresponding relationship between the current variable and the new expression can be stored in the mapping diagram. For example, the corresponding relationship between $q2 and 2+1+1 is stored in the mapping diagram, so that $q2 can be replaced when the variable row that references $q2 is located. For the row where the variable does not contain other variables in the expression, it can be skipped and the next row can be processed.

[0067] Exemplarily, after traversing all rows, all custom variables contained in the original alarm rule source code information are traversed, the position information of each custom variable in the original alarm rule expression is determined according to the relative position, and the position information is recorded, thereby realizing the recording of the position information of the custom variables contained in the original alarm rule source code information in the original alarm rule expression.

[0068] It should be noted that the embodiments of the present disclosure can construct a syntax tree based on the original alarm rule expression. Before performing the replacement process, parentheses can be added to the expression corresponding to each custom variable in the original alarm rule source code information to avoid being unable to restore the original expression after the syntax tree is constructed. For example, the expression of $q1 above can be (1+1), and the expression of $q2 after replacement processing can be 2+(1+1). For some special cases, such as when the referenced variable exists in the last alarm (warn) statement, parentheses do not need to be added.

[0069] Step 202: construct a syntax tree based on the original alarm rule expression.

[0070] Optionally, before step 202, the method may further include: determining the custom variables corresponding to each position in the original alarm rule expression according to the position information to obtain first information; and summarizing the preset type expressions corresponding to each custom variable to obtain second information. The advantage of such a setting is that the association between the variable and the expression is recorded more accurately, which facilitates the subsequent restoration of the variable name corresponding to each node in the syntax tree.

[0071] Optionally, after the syntax tree is constructed, the custom variables corresponding to each node in the syntax tree are determined according to the first information and the second information. The advantage of this setting is that it is convenient to quickly and accurately generate the target alarm rule source code information according to the adjusted syntax tree and the custom variables corresponding to each node in the syntax tree.

[0072] Exemplarily, any node in the syntax tree can be recorded as the third node. At this time, determining the custom variables corresponding to each node in the syntax tree according to the first information and the second information may include: querying the first information according to the first position of the leftmost leaf node of the third node to obtain the candidate custom variable corresponding to the first position; querying the preset type expression corresponding to the candidate custom variable in the second information, and when the queried first preset type expression is consistent with the preset type expression of the third node, the custom variable corresponding to the first preset type expression is recorded as the custom variable corresponding to the third node. The advantage of this setting is that the variable name corresponding to the node in the syntax tree can be accurately restored.

[0073] Step 203: split the alarm rule elements according to the expressions corresponding to the nodes in the syntax tree.

[0074] For the specific splitting method, please refer to the relevant description above.

[0075] Step 204: Filter out target alarm rule elements from the split alarm rule elements, wherein the target alarm rule elements contain adjustable items.

[0076] Step 205: Obtain historical data corresponding to the target alarm rule elements.

[0077] Step 206: Perform visual output processing on the changes in historical data, so that the user can input the adjustment target information of the corresponding adjustable item according to the visual output result.

[0078] Step 207: Adjust the corresponding adjustable items in the syntax tree according to the received adjustment target information.

[0079] Step 208: Generate target alarm rule source code information according to the adjusted syntax tree and the position information.

[0080] Optionally, after obtaining the target alarm rule source code information, the target alarm rule source code information may be sent to a corresponding monitoring system for application.

[0081] The information processing method provided by the embodiment of the present disclosure first performs de-variableization processing on the original alarm rule source code information containing custom variables to obtain the original alarm rule expression that does not contain custom variables, and records the position information of each custom variable in the original alarm rule expression, and then constructs a syntax tree based on the original alarm rule expression, splits the alarm rule elements according to the expressions corresponding to each node in the syntax tree, and filters out the target alarm rule elements containing adjustable items, and performs visual output processing on the changes in the corresponding historical data, so that users can intuitively adjust the adjustable items according to the change rules, adjust the syntax tree according to the adjustment target information input by the user, and finally automatically generate the target alarm rule source code information according to the adjusted syntax tree and position information, which effectively improves the debugging efficiency and accuracy of the alarm rules.

[0082] In some embodiments, the step of filtering out target alarm rule elements from the alarm rule elements obtained by splitting includes: filtering out alarm trigger conditions from the alarm rule elements obtained by splitting; for each alarm trigger condition filtered out, when it is determined that the alarm trigger threshold in the current alarm trigger condition is adjustable, determining the current alarm trigger condition as the target alarm rule element, and determining the alarm trigger threshold in the current alarm trigger condition as an adjustable item. The advantage of such a setting is that for many alarm rules, the alarm trigger threshold is an important adjustable item, and the target alarm rule elements can be filtered according to the alarm trigger threshold, so as to quickly optimize the alarm rules.

[0083] In some embodiments, the acquisition of historical data corresponding to the target alarm rule element and the visual output processing of the changes in the historical data include: acquiring the historical data corresponding to each time point in a preset historical period of the time series data monitoring target in the target alarm rule element; displaying the change curves corresponding to the historical data and the alarm trigger threshold in the target alarm rule element in a statistical chart coordinate system, and displaying the adjustment target information input control corresponding to the adjustable item, wherein the statistical chart coordinate system uses time and the time series data monitoring target as the horizontal axis and vertical axis respectively. The advantage of this setting is that the visual output processing can be more reasonably performed for the adjustment of the alarm trigger threshold, which is convenient for users to quickly and accurately debug the alarm trigger threshold that meets current needs.

[0084] Figure 3A flowchart of another information processing method provided in an embodiment of the present disclosure is provided, which is optimized based on the above optional embodiments, such as Figure 3 As shown, the method may include:

[0085] Step 301: Replace the original alarm rule source code information with custom variables to obtain the original alarm rule expression.

[0086] In order to facilitate understanding of the technical solution of the embodiment of the present disclosure, a relatively simple example is used as an example for explanation. Assume that the original alarm rule source code information is as follows:

[0087] $q1=1+1

[0088] $q2=2+$q1

[0089] $q1=$q2+1

[0090] $q3=$q1+$q2

[0091] warn=$q3>2

[0092] You can first add brackets to the expressions corresponding to each variable. Because when building the syntax tree, if the expression is not enclosed in brackets, it will be difficult to restore the original expression when building the tree. Therefore, add brackets to each expression with an operator in advance, and the final warn statement does not need to be added. You can get:

[0093] $q1=(1+1)

[0094] $q2=(2+$q1)

[0095] $q1=($q2+1)

[0096] $q3=($q1+$q2)

[0097] warn=$q3>2

[0098] After the custom variable is replaced, the final expression (((2+(1+1))+1)+(2+(1+1)))>2 can be obtained, that is, the original alarm rule expression is obtained. While de-variableizing, the position information of each variable in the final expression can be recorded, which can be used to restore the original variable name after dividing metrics, target, threshold, condition and trigger when constructing the syntax tree according to the final expression. The specific process of recording the position information is detailed in the subsequent steps. The reason for recording the position information here is that if this step is missing, the expression of each node obtained by dividing the Bosun syntax tree later cannot find the corresponding variable name or finds the wrong variable name, causing misunderstanding. In addition, because the statement finally executed by Bosun is a pure expression without a variable name (that is, the above-mentioned preset type expression), after adjusting the adjustable items, that is, after the syntax tree node is changed, if the syntax tree node does not correspond to the corresponding variable name, the corresponding specific position in the original alarm rule source code information with variables cannot be modified, that is, the change of the adjustable item cannot be matched with a string. It should be noted that after adding brackets as above, although the extra spaces and brackets are automatically removed from the syntax tree nodes after the Bosun syntax tree is built, the position (Pos) of each node is still relative to the original expression (that is, the final expression), so what needs to be recorded is the position of the first non-bracket and non-space character on the left of the expression corresponding to each variable in the final expression.

[0099] Step 302: Record the relative position of the first custom variable contained in the original alarm rule source code information in the preset type expression corresponding to the second custom variable.

[0100] In this step, it is equivalent to recording the position of the first character of the leftmost non-bracket non-space of each variable relative to the first character of the leftmost non-bracket non-space of the referenced variable. If the referenced variable is in a warn statement, since the warn statement does not add brackets, the position relative to the starting point can be directly recorded. In addition, for the case where there are repeated variables in the original alarm rule source code information, such as $q1 in the above example, the number of lines (Line) of the expression referenced by the variable in the original alarm rule source code information can be recorded. When calculating the relative position, only the number of lines where the referenced expression is greater than the number of lines where the variable is located can be calculated, that is, when the second custom variable references the first custom variable, the number of lines where the expression is located is greater than the line where the expression corresponding to the first custom variable is located, such as the number of lines where $q2=(2+$q1) is greater than the number of lines where $q1=(1+1) is located. In addition, after recording the number of lines, it is also convenient to accurately restore the number of lines of the expression of each variable in the original alarm rule source code information according to the adjusted syntax tree, so as to obtain more accurate target alarm rule source code information.

[0101] For the above example, the relative position calculation process is as follows:

[0102] 1. $q1 = (1 + 1), Line = 0, no other variables are used, so you can skip it;

[0103] 2. $q2=(2+$q1)=>(2+(1+1)), Line=1, $q2 byte expression=[0:'(',1:'2',2:'+',3:'(',4:'1',5:'+',6:'1',7:')',8:')'], the leftmost non-bracket and non-space character of $q2 is 1:'2', the leftmost non-bracket and non-space character of $q1 in the position of $q2 is 4:'1', so the position of $q1 relative to $q2 is 4-1=3;

[0104] 3. $q1=($q2+1)=>((2+(1+1))+1), Line=2, $q1 byte expression=[0:'(',1:'(',2:'2',3:'+',4:'(',5:'1',6:'+',7:'1',8:')',9:')',10:'+',11:'1',12:')'], the leftmost non-bracket and non-space character of $q1 is 2:'2', the leftmost non-bracket and non-space character of $q2 is 2:'2' in the position of $q1, so the position of $q2 relative to $q1 is 2-2=0;

[0105] 4.$q3=($q1+$q2)=>(((2+(1+1))+1)+(2+(1+1))), Line=3, $q3 byte expression=[0:'(',1:'(',2:'(',3:'2',4:'+',5:'(',6:'1',7:'+',8:'1',9:')',10:')',11:'+',12:'1',13:')',14:'+',15:'(',16:'2',17:'+' ,18:'(',19:'1',20:'+',21:'1',22:')',23:')',24:')'], the leftmost non-bracket, non-space character of $q3 is 3:'2', the leftmost non-bracket, non-space character of $q1 is 3:'2' in $q3, so the position of $q1 relative to $q3 is 3-3=0; the leftmost non-bracket, non-space character of $q2 is 16:'2' in $q3; so the position of $q2 relative to $q3 is 16-3=13;

[0106] 5.warn=$q3>2=>(((2+(1+1))+1)+(2+(1+1)))>2,Line=4,warn byte expression=[0:'(',1:'(',2:'(',3:'2',4:'+',5:'(',6:'1',7:'+',8:'1',9:')',10:')',11:'+',12:'1',13:')',14:'+',15:'( ',16:'2',17:'+',18:'(',19:'1',20:'+',21:'1',22:')',23:')',24:')',25:'>',26:'2'], because the warn statement only uses $q3, and in the end the warn statement does not need to be relative to the first character of the leftmost non-bracket and non-space, but can be directly relative to the starting point, so the position of $q3 in the warn statement is 3:'2'.

[0107] It can be recorded in the following form, where Name represents the variable name of the second custom variable, Pos represents the relative position, and Line represents the line number.

[0108] When $q1 is used as the first custom variable: Name is $q2, Pos is 3, Line is 1; Name is $q3, Pos is 0, Line is 3;

[0109] When $q2 is used as the first custom variable: Name is $q1, Pos is 0, Line is 2; Name is $q3, Pos is 13, Line is 3;

[0110] When $q3 is used as the first custom variable: Name is warn, Pos is 3, and Line is 4.

[0111] Step 303: traverse all the custom variables contained in the original alarm rule source code information, determine the position information of each custom variable in the original alarm rule expression according to the relative position, and record the position information.

[0112] The position information can be expressed as an offset. For example, the offset can be calculated as follows:

[0113] The offsets of $q1 are 9, 19 and 3. Among them, [$q1 in$q2=3]+[$q2 in$q1=0]+[$q1 in$q3=3]+[$q3 in warn=3]=3+0+3+3=9, $q1 in$q2=3 means that the relative position of $q1 in $q2 is 3; [$q1in$q2=3]+[$q2 in$q3=13]+[$q3 in warn=3]=3+13+3=19; [$q1 in$q3=0]+[$q3 inwarn=3]=0+3=3.

[0114] The offsets of $q2 are 3 and 16. Among them, [$q2 in$q1=0]+[$q1 in$q3=0]+[$q3 in warn=3]=0+0+3=3; [$q2 in$q3=13]+[$q3 in warn=3]=13+3=16.

[0115] The offset of $q2 is 3, where [$q3 in warn=3]=3.

[0116] It can be seen that the same custom variable may have multiple offsets in the original alarm rule expression.

[0117] Step 304: Determine the custom variables corresponding to each position in the original alarm rule expression according to the position information to obtain first information.

[0118] Exemplarily, this step can be understood as calculating the possible corresponding variable names of each position relative to the starting position in the original alarm rule expression, so that the subsequent syntax tree can find the possible corresponding variable names through the position on the node.

[0119] As shown in the above example, the first information can be expressed as: the variable name corresponding to the position "16" can be $q2, the variable name corresponding to the position "9" can be $q1, the variable name corresponding to the position "19" can be $q1, and the variable name corresponding to the position "3" can be $q3, $q2 and $q1.

[0120] Step 305: Summarize the preset type expressions corresponding to each custom variable to obtain second information.

[0121] Exemplarily, Value can be used to represent the preset type expression corresponding to the custom variable, and the second information can be obtained as in the above example:

[0122] $q1: Value is 1+1, Line is 0; Value is 2+1+1+1, Line is 2.

[0123] $q2: Value is 2+1+1, Line is 1.

[0124] $q2: Value is 2+1+1+1+2+1+1, and Line is 3.

[0125] Step 306: construct a syntax tree based on the original alarm rule expression.

[0126] Figure 4 A schematic diagram of a syntax tree structure provided by an embodiment of the present disclosure, such as Figure 4 As shown in FIG. 1 , a syntax tree is constructed based on the original alarm rule expression that does not contain custom variables.

[0127] Step 307: Determine the custom variable corresponding to each node in the syntax tree according to the first information and the second information.

[0128] Figure 5 A schematic diagram of another syntax tree structure provided in an embodiment of the present disclosure is shown in FIG. Figure 5 As shown, in Figure 4 On this basis, corresponding custom variables are determined for each node.

[0129] For example, taking node 2+1+1, the leftmost leaf node is 2 and the corresponding position is 3. By querying the first information, it can be obtained that the possible corresponding variables are $q3, $q2 and $q1. Then querying the second information, it is found that the Value of $q2 is 2+1+1. Therefore, the custom variable corresponding to this node is $q2.

[0130] Step 308: split the alarm rule elements according to the expressions corresponding to the nodes in the syntax tree, and filter out the alarm triggering conditions from the alarm rule elements obtained by splitting.

[0131] For example, the alarm rule elements can be split according to the expressions corresponding to each node in the syntax tree based on metrics, target, threshold, condition and trigger. The alarm rules can be standardized by splitting, so that the machine can understand the alarm rules, which is convenient for extracting key expressions, that is, target alarm rule elements, according to the needs. In addition, in order to effectively distinguish the alarm rule elements, an identification (ID) corresponding to each alarm rule element can be generated after the splitting.

[0132] Figure 6 A schematic diagram of splitting alarm rule elements based on a syntax tree is provided in an embodiment of the present disclosure, such as Figure 6As shown in the figure, for the above example, since it is only a simple example and no data source is associated, it can be considered that metrics is none; the expression "q3>2" containing ">" is determined as condition, the corresponding variable name can be warn, and the ID is 1; the expression "(((2+(1+1))+1)+(2+(1+1)))" on the left side of ">" is determined as target, the corresponding variable name can be q3, and the ID is 2; the expression "2" on the left side of ">" is determined as threshold, without a corresponding variable name, and the ID is 3; since there is only one condition, trigger is the same as condition.

[0133] Exemplarily, when the threshold needs to be adjusted, the alarm triggering condition, that is, the condition, can be filtered out from the separated alarm rule elements.

[0134] Step 309: For each alarm trigger condition screened out, when it is determined that the alarm trigger threshold in the current alarm trigger condition is adjustable, the current alarm trigger condition is determined as a target alarm rule element, and the alarm trigger threshold in the current alarm trigger condition is determined as an adjustable item.

[0135] For example, the basis for judging whether the alarm trigger threshold is adjustable may be whether the expression corresponding to the alarm trigger threshold is a pure mathematical expression (such as 2 or 1+1, etc., or a mathematical expression with variables, such as a+1, etc.), if so, it is considered to be adjustable. If the expression corresponding to the alarm trigger threshold is not a pure mathematical expression, for example, it contains a time series, it is considered to be unadjustable.

[0136] As in the above example, there is only one condition. Since the threshold is 2, it is a pure mathematical expression and can be adjusted, so q3>2 can become an element of the target alarm rule.

[0137] Step 310: Obtain the historical data corresponding to each time point in the preset historical period of the time series data monitoring target in the target alarm rule element.

[0138] Exemplarily, for the alarm triggering conditions that become elements of the target alarm rule, the historical data corresponding to each time point of the time series data monitoring target within a preset historical period can be obtained, and the specific acquisition method is not limited.

[0139] Step 311: Display the change curves corresponding to the alarm triggering thresholds in the historical data and the target alarm rule elements in the statistical chart coordinate system, and display the adjustment target information input controls corresponding to the adjustable items.

[0140] The coordinate system of the statistical graph has time as the horizontal axis and the time series data monitoring target as the vertical axis. Figure 7 A schematic diagram of a display interface provided by an embodiment of the present disclosure, such as Figure 7 As shown, since the value of q3 in the above simple example is 9 at any time, the change curve corresponding to q3 is a straight line parallel to the horizontal axis with a vertical coordinate of 9. The alarm trigger threshold is 2, so the change curve corresponding to the alarm trigger threshold is a straight line parallel to the horizontal axis with a vertical coordinate of 2. The adjustment target information input control corresponding to the alarm trigger threshold can be displayed above the statistical coordinate graph, as shown in the box in the figure. The user can enter the adjustment target information in the box. Since the current alarm trigger threshold is 2, and 9>2, the alarm will be triggered. If the actual business needs do not want to trigger the alarm, you can adjust 2. Figure 8 Another display interface schematic diagram provided by the embodiment of the present disclosure is as follows: Figure 8 As shown in the figure, if 10 is entered in the box, the alarm trigger threshold value becomes 10. At this time, the change curve corresponding to the alarm trigger threshold value is a straight line parallel to the horizontal axis with a vertical coordinate of 10, and the alarm will not be triggered.

[0141] Step 312: Adjust the corresponding adjustable items in the syntax tree according to the received adjustment target information, and generate target alarm rule source code information according to the adjusted syntax tree and the custom variables corresponding to each node in the syntax tree.

[0142] Exemplarily, after adjusting the alarm trigger threshold, the value 2 corresponding to the alarm trigger threshold in the syntax tree is modified to 10, and then the target alarm rule source code information is generated according to the adjusted syntax tree and the custom variables corresponding to each node in the syntax tree.

[0143] Optionally, an area for displaying the source code information of the alarm rule may be provided on the display interface, and the original source code information of the alarm rule may be displayed before adjustment, and the target source code information of the alarm rule may be displayed after adjustment. Exemplarily, the area may be displayed above the input control for adjusting the target information. Fig. 9 A schematic diagram of another display interface provided by an embodiment of the present disclosure, such as Fig. 9 As shown, after the value 2 corresponding to the alarm trigger threshold is changed to 10, the target alarm rule source code information is automatically displayed in the alarm rule source code information display area.

[0144] The information processing method provided by the embodiment of the present disclosure first performs de-variableization processing on the original alarm rule source code information containing custom variables to obtain the original alarm rule expression that does not contain custom variables, and records the position information of each custom variable in the original alarm rule expression, and then constructs a syntax tree based on the original alarm rule expression, splits the alarm rule elements according to the expressions corresponding to each node in the syntax tree, and filters out the target alarm trigger conditions containing adjustable alarm trigger thresholds, and uses statistical charts to perform visual output processing on the change curves of historical data corresponding to the time series data monitoring target in the target alarm trigger conditions and the change curves corresponding to the alarm trigger thresholds, so that users can intuitively adjust the alarm trigger thresholds according to the change rules of historical data, and adjust the syntax tree according to the expected alarm trigger thresholds input by the user, and finally automatically generate the target alarm rule source code information according to the adjusted syntax tree, which effectively improves the debugging efficiency and accuracy of the alarm rules.

[0145] It should be noted that the above example is relatively simple. In actual applications, the alarm rules may be more complicated. The following is a slightly more complicated example for further explanation:

[0146] Assume that the original alarm rule source code information is as follows:

[0147] $metrics="sum:rate:go.{psm}.numGos"

[0148] $numGos1=avg(q($metrics,"3m","2m"))

[0149] $numGos2=avg(q($metrics,"4m","3m"))

[0150] $condition1=$numGos1>120

[0151] $condition2=$numGos2>200

[0152] $trigger=$condition1&&$condition2

[0153] warn=$trigger

[0154] De-variation processing is performed on the original alarm rule source code information, and the original alarm rule source code information is converted into a specific expression, which can be obtained:

[0155] avg(q("sum:rate:go.{psm}.numGos","3m","2m"))>120&&avg(q("sum:rate:go.{psm}.numGos","4m","3m")))>200

[0156] Based on the above expression, a syntax tree is constructed and the alarm rule elements are split. Fig.10 Another schematic diagram of splitting alarm rule elements based on a syntax tree provided in an embodiment of the present disclosure is as follows: Fig.10 As shown in the figure, metrics is $metrics, trigger is $trigger, condition is $condition1 and $condition2, target is $numGos1 and $numGos2, and threshold is 120 and 200.

[0157] The user can focus only on the two expressions $numGos1>120 and $numGos2>200, and can obtain the historical data of $numGos1 and $numGos2 for the past 6 hours, and draw corresponding statistical charts to facilitate users to observe the changes in historical data. By adjusting the two thresholds of 120 and 200, the computer device can automatically and synchronously modify the corresponding values ​​in the original alarm rule source code information to generate the target alarm rule source code information.

[0158] It can be seen that by adopting the technical solution provided by the embodiment of the present disclosure, the key expressions in the alarm rules that determine the triggering of the alarm and the parts that the user often adjusts are extracted, so that the user can pay more attention to the monitoring target without having to pay attention to the complete and complex alarm rules. By simulating the historical curves of the target and threshold in the condition on a graph, the user can intuitively observe the expression of the historical curve and quickly adjust the threshold. By locating the variable or expression in the syntax tree and the original alarm rule position and modifying the value in the expression, the alarm rule can be automatically associated and modified, thereby reducing the difficulty of editing the alarm rule.

[0159] Fig.11 This is a structural block diagram of an information processing device provided by an embodiment of the present disclosure. The device can be implemented by software and / or hardware, can generally be integrated into a computer device, and can perform information processing by executing an information processing method. Fig.11 As shown, the device comprises:

[0160] A rule expression acquisition module 1101 is used to acquire the original alarm rule expression corresponding to the original alarm rule source code information;

[0161] The target alarm rule element determination module 1102 is used to split the original alarm rule expression into alarm rule elements, and filter out the target alarm rule elements from the split alarm rule elements, wherein the target alarm rule elements include adjustable items;

[0162] The visualization processing module 1103 is used to obtain the historical data corresponding to the target alarm rule elements, and perform visualization output processing on the changes of the historical data, so that the user can input the adjustment target information of the corresponding adjustable items according to the visualization output results;

[0163] The target alarm rule source code generating module 1104 is used to adjust the corresponding adjustable items according to the received adjustment target information, and generate the target alarm rule source code information according to the adjusted alarm rule elements.

[0164] The information processing device provided in the embodiment of the present disclosure can automatically filter out adjustable items in the alarm rule source code, and visualize the changes in historical data corresponding to the alarm rule elements to which the adjustable items belong, so that the user can more intuitively view the changing trends of historical data, and then quickly set reasonable target values ​​for the adjustable items. After the adjustment is completed, the adjusted target alarm rule source code information is automatically generated, thereby improving the debugging efficiency of the alarm rule source code.

[0165] Optionally, the original alarm rule expression is a preset type expression, which does not contain custom variables, and the obtaining of the original alarm rule expression corresponding to the original alarm rule source code information includes: replacing the original alarm rule source code information with custom variables to obtain the original alarm rule expression, wherein, during the replacement process, the position information of the custom variables contained in the original alarm rule source code information in the original alarm rule expression is recorded; accordingly, generating the target alarm rule source code information according to the adjusted alarm rule elements includes: generating the target alarm rule source code information according to the adjusted alarm rule elements and the position information.

[0166] Optionally, the splitting of the original alarm rule expression into alarm rule elements includes: constructing a syntax tree based on the original alarm rule expression; splitting the alarm rule elements according to the expressions corresponding to each node in the syntax tree; accordingly, adjusting the corresponding adjustable items according to the received adjustment target information, and generating target alarm rule source code information according to the adjusted alarm rule elements, including: adjusting the corresponding adjustable items in the syntax tree according to the received adjustment target information; generating target alarm rule source code information according to the adjusted syntax tree and the position information.

[0167] Optionally, the alarm rule elements include time series data monitoring targets, alarm triggering thresholds, alarm triggering conditions and alarm triggering condition combinations.

[0168] Optionally, the alarm rule elements are split according to the expressions corresponding to the nodes in the syntax tree, including: determining a first expression corresponding to the first node in the syntax tree as an alarm trigger condition, wherein the first expression contains mathematical relationship symbols; determining one side of the mathematical relationship symbols in the first expression as a time series data monitoring target, and the other side as an alarm trigger threshold; determining a second expression corresponding to the second node in the syntax tree as an alarm trigger condition combination, wherein the second expression includes alarm trigger conditions, and when the second expression contains at least two alarm trigger conditions, the at least two alarm trigger conditions are connected by logical operation symbols.

[0169] Optionally, the recording of position information of custom variables contained in the original alarm rule source code information in the original alarm rule expression includes: recording the relative position of a first custom variable contained in the original alarm rule source code information in a preset type expression corresponding to a second custom variable; traversing all custom variables contained in the original alarm rule source code information, determining the position information of each custom variable in the original alarm rule expression according to the relative position, and recording the position information.

[0170] Optionally, the device also includes: a first information determination module, which is used to determine the custom variables corresponding to each position in the original alarm rule expression according to the position information to obtain first information before constructing the syntax tree based on the original alarm rule expression; a first information determination module, which is used to summarize the preset type expression corresponding to each custom variable to obtain second information; a node variable determination module, which is used to determine the custom variables corresponding to each node in the syntax tree according to the first information and the second information before splitting the alarm rule elements according to the expressions corresponding to each node in the syntax tree; accordingly, generating the target alarm rule source code information according to the adjusted syntax tree and the position information includes: generating the target alarm rule source code information according to the adjusted syntax tree and the custom variables corresponding to each node in the syntax tree.

[0171] Optionally, any node in the syntax tree is recorded as a third node, and the custom variables corresponding to each node in the syntax tree are determined according to the first information and the second information, including: querying the first information according to the first position of the leftmost leaf node of the third node to obtain a candidate custom variable corresponding to the first position; querying the preset type expression corresponding to the candidate custom variable in the second information, and when the queried first preset type expression is consistent with the preset type expression of the third node, the custom variable corresponding to the first preset type expression is recorded as the custom variable corresponding to the third node.

[0172] Optionally, filtering out target alarm rule elements from the split alarm rule elements includes: filtering out alarm trigger conditions from the split alarm rule elements; for each screened alarm trigger condition, when it is determined that the alarm trigger threshold in the current alarm trigger condition is adjustable, determining the current alarm trigger condition as the target alarm rule element, and determining the alarm trigger threshold in the current alarm trigger condition as an adjustable item.

[0173] Optionally, the historical data corresponding to the target alarm rule element is obtained, and the changes in the historical data are visually outputted, including: obtaining the historical data corresponding to the time series data monitoring target in the target alarm rule element at each time point within a preset historical period; displaying the change curves corresponding to the historical data and the alarm trigger threshold in the target alarm rule element in a statistical chart coordinate system, and displaying the adjustment target information input control corresponding to the adjustable item, wherein the statistical chart coordinate system uses time and the time series data monitoring target as the horizontal axis and the vertical axis respectively.

[0174] Reference below Fig.12 , which shows a schematic diagram of the structure of a computer device 1200 suitable for implementing the embodiments of the present disclosure. The computer device in the embodiments of the present disclosure may include, but is not limited to, mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Fig.12 The computer device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0175] like Fig.12As shown, the computer device 1200 may include a processing device (e.g., a central processing unit, a graphics processor, etc.) 1201, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1202 or a program loaded from a storage device 1208 to a random access memory (RAM) 1203. Various programs and data required for the operation of the computer device 1200 are also stored in the RAM 1203. The processing device 1201, the ROM 1202, and the RAM 1203 are connected to each other via a bus 1204. An input / output (I / O) interface 1205 is also connected to the bus 1204.

[0176] Typically, the following devices may be connected to the I / O interface 1205: input devices 1206 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; output devices 1207 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 1208 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 1209. The communication devices 1209 may allow the computer device 1200 to communicate with other devices wirelessly or by wire to exchange data. Although Fig.12 The computer device 1200 is shown with various devices, but it should be understood that it is not required to implement or have all the devices shown. More or fewer devices may be implemented or have instead.

[0177] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 1209, or installed from the storage device 1208, or installed from the ROM 1202. When the computer program is executed by the processing device 1201, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0178] It should be noted that the computer-readable medium disclosed above may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0179] The computer-readable medium may be included in the computer device, or may exist independently without being incorporated into the computer device.

[0180] The above-mentioned computer-readable medium carries one or more programs. When the above-mentioned one or more programs are executed by the computer device, the computer device is enabled to: split the alarm rule elements of the original alarm rule expression, and filter out the target alarm rule elements from the alarm rule elements obtained by the split, wherein the target alarm rule elements include adjustable items; obtain the historical data corresponding to the target alarm rule elements, and perform visual output processing on the changes of the historical data so that the user can input the adjustment target information of the corresponding adjustable items according to the visual output results; adjust the corresponding adjustable items according to the received adjustment target information, and generate the target alarm rule source code information according to the adjusted alarm rule elements.

[0181] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0182] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0183] The modules involved in the embodiments described in the present disclosure may be implemented by software or hardware. The name of a module does not limit the module itself in some cases. For example, a rule expression acquisition module may also be described as a "module for acquiring the original alarm rule expression corresponding to the original alarm rule source code information."

[0184] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0185] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0186] According to one or more embodiments of the present disclosure, there is provided an information processing method, including:

[0187] Obtain the original alarm rule expression corresponding to the original alarm rule source code information;

[0188] Splitting the original alarm rule expression into alarm rule elements, and filtering out target alarm rule elements from the alarm rule elements obtained by splitting, wherein the target alarm rule elements include adjustable items;

[0189] Acquire historical data corresponding to the target alarm rule elements, and perform visual output processing on changes in the historical data, so that the user can input adjustment target information of the corresponding adjustable items according to the visual output results;

[0190] The corresponding adjustable items are adjusted according to the received adjustment target information, and the target alarm rule source code information is generated according to the adjusted alarm rule elements.

[0191] Further, the original alarm rule expression is a preset type expression, and the preset type expression does not contain a custom variable. The original alarm rule expression corresponding to the original alarm rule source code information is obtained, including:

[0192] Performing a replacement process of the custom variables on the original alarm rule source code information to obtain the original alarm rule expression, wherein, during the replacement process, the position information of the custom variables contained in the original alarm rule source code information in the original alarm rule expression is recorded;

[0193] Correspondingly, the generating of target alarm rule source code information according to the adjusted alarm rule elements includes:

[0194] The target alarm rule source code information is generated according to the adjusted alarm rule elements and the position information.

[0195] Furthermore, the decomposing the original alarm rule expression into alarm rule elements includes:

[0196] Constructing a syntax tree based on the original alarm rule expression;

[0197] Splitting alarm rule elements according to expressions corresponding to nodes in the syntax tree;

[0198] Accordingly, the corresponding adjustable items are adjusted according to the received adjustment target information, and the target alarm rule source code information is generated according to the adjusted alarm rule elements, including:

[0199] Adjusting corresponding adjustable items in the syntax tree according to the received adjustment target information;

[0200] The target alarm rule source code information is generated according to the adjusted syntax tree and the position information.

[0201] Furthermore, the alarm rule elements include time series data monitoring targets, alarm triggering thresholds, alarm triggering conditions and alarm triggering condition combinations.

[0202] Furthermore, the alarm rule element splitting according to the expression corresponding to each node in the syntax tree includes:

[0203] Determine a first expression corresponding to a first node in the syntax tree as an alarm triggering condition, wherein the first expression contains mathematical relationship symbols;

[0204] Determine one side of the mathematical relationship symbol in the first expression as a time series data monitoring target, and determine the other side as an alarm triggering threshold;

[0205] The second expression corresponding to the second node in the syntax tree is determined as an alarm trigger condition combination, wherein the second expression includes alarm trigger conditions, and when the second expression contains at least two alarm trigger conditions, the at least two alarm trigger conditions are connected by logical operation symbols.

[0206] Furthermore, the recording of the position information of the custom variables contained in the original alarm rule source code information in the original alarm rule expression includes:

[0207] Recording the relative position of the first custom variable contained in the original alarm rule source code information in the preset type expression corresponding to the second custom variable;

[0208] All the custom variables contained in the original alarm rule source code information are traversed, the position information of each custom variable in the original alarm rule expression is determined according to the relative position, and the position information is recorded.

[0209] Furthermore, before constructing the syntax tree based on the original alarm rule expression, the method further includes:

[0210] Determine the custom variables corresponding to each position in the original alarm rule expression according to the position information to obtain first information;

[0211] Summarize the preset type expressions corresponding to each custom variable to obtain the second information;

[0212] Accordingly, before splitting the alarm rule elements according to the expressions corresponding to the nodes in the syntax tree, the method further includes:

[0213] Determine a custom variable corresponding to each node in the syntax tree according to the first information and the second information;

[0214] Correspondingly, the generating of target alarm rule source code information according to the adjusted syntax tree and the position information includes:

[0215] The target alarm rule source code information is generated according to the adjusted syntax tree and the custom variables corresponding to each node in the syntax tree.

[0216] Further, any node in the syntax tree is recorded as a third node, and the step of determining the custom variables corresponding to each node in the syntax tree according to the first information and the second information includes:

[0217] querying the first information according to the first position of the leftmost leaf node of the third node to obtain a candidate custom variable corresponding to the first position;

[0218] The preset type expression corresponding to the candidate custom variable is queried in the second information. When the queried first preset type expression is consistent with the preset type expression of the third node, the custom variable corresponding to the first preset type expression is recorded as the custom variable corresponding to the third node.

[0219] Furthermore, the step of selecting target alarm rule elements from the alarm rule elements obtained by splitting includes:

[0220] Filter out alarm triggering conditions from the alarm rule elements obtained by splitting;

[0221] For each alarm trigger condition screened out, when it is determined that the alarm trigger threshold in the current alarm trigger condition is adjustable, the current alarm trigger condition is determined as a target alarm rule element, and the alarm trigger threshold in the current alarm trigger condition is determined as an adjustable item.

[0222] Furthermore, the acquiring of historical data corresponding to the target alarm rule element and visual output processing of changes in the historical data includes:

[0223] Obtain the historical data corresponding to each time point in the preset historical period of the time series data monitoring target in the target alarm rule element;

[0224] The change curves corresponding to the alarm trigger thresholds in the historical data and the target alarm rule elements are displayed in the statistical chart coordinate system, as well as the adjustment target information input controls corresponding to the adjustable items, wherein the statistical chart coordinate system uses time and the time series data monitoring target as the horizontal axis and the vertical axis respectively.

[0225] According to one or more embodiments of the present disclosure, there is provided an information processing device, including:

[0226] A rule expression acquisition module is used to obtain the original alarm rule expression corresponding to the original alarm rule source code information;

[0227] A target alarm rule element determination module is used to split the original alarm rule expression into alarm rule elements, and filter out target alarm rule elements from the split alarm rule elements, wherein the target alarm rule elements include adjustable items;

[0228] A visualization processing module, used to obtain the historical data corresponding to the target alarm rule elements, and perform visualization output processing on the changes of the historical data, so that the user can input the adjustment target information of the corresponding adjustable items according to the visualization output results;

[0229] The target alarm rule source code generation module is used to adjust the corresponding adjustable items according to the received adjustment target information, and generate the target alarm rule source code information according to the adjusted alarm rule elements.

[0230] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other to form a technical solution.

[0231] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0232] Although the subject matter has been described in language specific to structural features and / or methodological logical actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims.

Claims

1. An information processing method, characterized in that: include: Obtaining an original alarm rule expression corresponding to the original alarm rule source code information, wherein the alarm rule expression is an expression corresponding to the complete alarm rule, and the alarm rule expression is a Boolean expression formed by connecting multiple expressions through mathematical relationship symbols and / or logical operation symbols, and the original alarm rule expression is determined by the alarm rule expression corresponding to the original alarm rule source code information; The original alarm rule expression is split into alarm rule elements, and a target alarm rule element is screened out from the alarm rule elements obtained by the splitting, wherein the target alarm rule element contains adjustable items, the alarm rule element includes at least one of a time series data monitoring target, an alarm triggering threshold, an alarm triggering condition, and an alarm triggering condition combination mode, and the adjustable item includes an item in the alarm rule that the user is allowed to adjust; Acquire historical data corresponding to the target alarm rule elements, and perform visual output processing on changes in the historical data, so that the user can input adjustment target information of the corresponding adjustable items according to the visual output results; The corresponding adjustable items are adjusted according to the received adjustment target information, and the target alarm rule source code information is generated according to the adjusted alarm rule elements.

2. The method according to claim 1, characterized in that The original alarm rule expression is a preset type expression, and the preset type expression does not contain a custom variable. The original alarm rule expression corresponding to the original alarm rule source code information is obtained, including: Performing a replacement process of the custom variables on the original alarm rule source code information to obtain the original alarm rule expression, wherein, during the replacement process, the position information of the custom variables contained in the original alarm rule source code information in the original alarm rule expression is recorded; Correspondingly, the generating of target alarm rule source code information according to the adjusted alarm rule elements includes: The target alarm rule source code information is generated according to the adjusted alarm rule elements and the position information.

3. The method according to claim 2, characterized in that The step of splitting the original alarm rule expression into alarm rule elements includes: Constructing a syntax tree based on the original alarm rule expression; Splitting alarm rule elements according to expressions corresponding to nodes in the syntax tree; Accordingly, the corresponding adjustable items are adjusted according to the received adjustment target information, and the target alarm rule source code information is generated according to the adjusted alarm rule elements, including: Adjusting corresponding adjustable items in the syntax tree according to the received adjustment target information; The target alarm rule source code information is generated according to the adjusted syntax tree and the position information.

4. The method according to claim 3, characterized in that The step of splitting alarm rule elements according to expressions corresponding to nodes in the syntax tree includes: Determine a first expression corresponding to a first node in the syntax tree as an alarm triggering condition, wherein the first expression contains mathematical relationship symbols; Determine one side of the mathematical relationship symbol in the first expression as a time series data monitoring target, and determine the other side as an alarm triggering threshold; The second expression corresponding to the second node in the syntax tree is determined as an alarm trigger condition combination, wherein the second expression includes alarm trigger conditions, and when the second expression contains at least two alarm trigger conditions, the at least two alarm trigger conditions are connected by logical operation symbols.

5. The method according to claim 3, characterized in that: The recording of the position information of the custom variables contained in the original alarm rule source code information in the original alarm rule expression includes: Recording the relative position of the first custom variable contained in the original alarm rule source code information in the preset type expression corresponding to the second custom variable; All the custom variables contained in the original alarm rule source code information are traversed, the position information of each custom variable in the original alarm rule expression is determined according to the relative position, and the position information is recorded.

6. The method according to claim 5, characterized in that Before constructing the syntax tree based on the original alarm rule expression, the method further includes: Determine the custom variables corresponding to each position in the original alarm rule expression according to the position information to obtain first information; Summarize the preset type expressions corresponding to each custom variable to obtain the second information; Accordingly, before splitting the alarm rule elements according to the expressions corresponding to the nodes in the syntax tree, the method further includes: Determine a custom variable corresponding to each node in the syntax tree according to the first information and the second information; Correspondingly, the generating of target alarm rule source code information according to the adjusted syntax tree and the position information includes: The target alarm rule source code information is generated according to the adjusted syntax tree and the custom variables corresponding to each node in the syntax tree.

7. The method according to claim 6, characterized in that Recording any node in the syntax tree as a third node, and determining the custom variables corresponding to each node in the syntax tree according to the first information and the second information includes: querying the first information according to the first position of the leftmost leaf node of the third node to obtain a candidate custom variable corresponding to the first position; The preset type expression corresponding to the candidate custom variable is queried in the second information. When the queried first preset type expression is consistent with the preset type expression of the third node, the custom variable corresponding to the first preset type expression is recorded as the custom variable corresponding to the third node.

8. The method according to claim 4, characterized in that The step of selecting target alarm rule elements from the alarm rule elements obtained by splitting includes: Filter out alarm triggering conditions from the alarm rule elements obtained by splitting; For each alarm trigger condition screened out, when it is determined that the alarm trigger threshold in the current alarm trigger condition is adjustable, the current alarm trigger condition is determined as a target alarm rule element, and the alarm trigger threshold in the current alarm trigger condition is determined as an adjustable item.

9. The method according to claim 8, characterized in that The obtaining of historical data corresponding to the target alarm rule element and performing visual output processing on changes in the historical data includes: Obtain the historical data corresponding to each time point in the preset historical period of the time series data monitoring target in the target alarm rule element; The change curves corresponding to the alarm trigger thresholds in the historical data and the target alarm rule elements are displayed in the statistical chart coordinate system, as well as the adjustment target information input controls corresponding to the adjustable items, wherein the statistical chart coordinate system uses time and the time series data monitoring target as the horizontal axis and the vertical axis respectively.

10. An information processing device, characterized in that: include: A rule expression acquisition module is used to acquire an original alarm rule expression corresponding to the original alarm rule source code information, wherein the alarm rule expression is an expression corresponding to the complete alarm rule, and the alarm rule expression is a Boolean expression formed by connecting multiple expressions through mathematical relationship symbols and / or logical operation symbols, and the original alarm rule expression is determined by the alarm rule expression corresponding to the original alarm rule source code information; A target alarm rule element determination module is used to split the alarm rule elements of the original alarm rule expression, and filter out the target alarm rule elements from the alarm rule elements obtained by the splitting, wherein the target alarm rule elements contain adjustable items, the alarm rule elements include at least one of the time series data monitoring target, the alarm trigger threshold, the alarm trigger condition and the alarm trigger condition combination mode, and the adjustable items include items in the alarm rule that the user is allowed to adjust; A visualization processing module, used to obtain the historical data corresponding to the target alarm rule elements, and perform visualization output processing on the changes of the historical data, so that the user can input the adjustment target information of the corresponding adjustable items according to the visualization output results; The target alarm rule source code generation module is used to adjust the corresponding adjustable items according to the received adjustment target information, and generate the target alarm rule source code information according to the adjusted alarm rule elements.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 9 is implemented.

12. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 9 is implemented.

Images